Vulnerabilidades em openemr

148 resultados
Análise Vexday

O OpenEMR acumula 120 CVEs catalogadas, com 7 classificadas como críticas e nenhuma confirmada em exploração ativa no catálogo CISA KEV, taxa abaixo da média geral do catálogo. Apesar da ausência de exploração ativa confirmada, o cenário merece atenção: CVE-2023-2948 apresenta score EPSS de 0,9673, indicando probabilidade muito elevada de exploração nos próximos 30 dias e devendo ser tratada como prioridade imediata de remediação. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), o que sugere fragilidades persistentes no tratamento de entradas do usuário na aplicação. A existência de PoC pública para ao menos uma vulnerabilidade eleva o risco operacional, especialmente em ambientes de saúde onde o sistema frequentemente lida com dados sensíveis de pacientes.

CVE-2023-2944MEDIUMImproper Access Control in openemr/openemrEPSS 0.4%CVE-2026-33910HIGHOpenEMR has a SQL Injection Vulnerability in patient selectionEPSS 0.4%CVE-2026-115573HIGHOpenEMR: Broken Access Control in controller.php Enables Insurance Routing Credential Hijack and PHI EnumerationEPSS 0.4%CVE-2026-102940CRITICALOpenEMR: Missing Write ACL Allows Unauthorized Document ReassignmentEPSS 0.4%CVE-2026-104135MEDIUMOpenEMR: Missing authorization in payment patient-search AJAX leaks patient directory and dates of birthEPSS 0.4%CVE-2026-33914HIGHOpenEMR has SQL Injection in PostCalendar Category DeleteEPSS 0.4%CVE-2026-34053HIGHOpenEMR Missing Authorization in Procedure Order AJAX Deletion HandlerEPSS 0.4%CVE-2023-2945MEDIUMMissing Authorization in openemr/openemrEPSS 0.4%CVE-2025-54373HIGHOpenEMR may expose Contents of Clinical Notes and Care Planto users who do not have Sensitivities=high privilegeEPSS 0.4%CVE-2026-76614MEDIUMOpenEMR < 8.3.0 Path Traversal Information Disclosure via EDI Archive RestoreEPSS 0.4%CVE-2025-67645HIGHOpenEMR Vulnerable to Broken Access Control in Profile Edit EndpointEPSS 0.4%CVE-2024-0875HIGHStored XSS in openemr/openemrEPSS 0.4%CVE-2026-103939MEDIUMOpenEMR: Weno `file_download.php`: missing ACL/CSRF truncates the e-prescribing pharmacy directoryEPSS 0.4%CVE-2026-104133HIGHOpenEMR: Missing authorization in DORN `compendium_install.php` — non-admin destructive lab-compendium reinstallEPSS 0.4%CVE-2026-32127HIGHSQL Injection Vulnerability in ajax graphs library (OpenEMR)EPSS 0.4%CVE-2026-25131HIGHOpenEMR has Broken Access Control in Procedures ConfigurationEPSS 0.4%CVE-2026-33931MEDIUMOpenEMR has IDOR in Portal Payment Page that Allows Cross-Patient Record AccessEPSS 0.4%CVE-2026-49142HIGHOpenEMR Before 8.5.0 SQL Injection via form_icd_codes[]EPSS 0.4%CVE-2026-25476HIGHOpenEMR has Session Timeout Bypass via skip_timeout_resetEPSS 0.4%CVE-2026-103020MEDIUMOpenEMR: Unauthenticated Information Disclosure in admin.php Exposes Database Names and VersionsEPSS 0.4%